Tackle.io · Authentication Profile

Tackleio Authentication

Authentication

Tackle.io secures its APIs with apiKey, http, and oauth2 across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyCloudCloud MarketplaceCo-SellAWS MarketplaceAzure MarketplaceGoogle Cloud MarketplacePrivate OffersMeteringSCIMWebhooksB2B SaaS
Methods: apiKey, http, oauth2 Schemes: 5 OAuth flows: clientCredentials API key in: header

Security Schemes

tackleJwt http
scheme: bearer
BasicAuthCallback http
scheme: basic
HeaderApiKeyAuthCallback apiKey
· in: header (subscription-key)
Oauth2AuthCallback oauth2
· flows: clientCredentials
ApiKeyAuth apiKey
· in: header (Authorization)

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-21'
method: searched
source: openapi/tackleio-contracts-openapi.json, openapi/tackleio-cosell-aws-openapi.json, openapi/tackleio-cosell-gcp-openapi.json,
  openapi/tackleio-cosell-msft-openapi.json, openapi/tackleio-offers-aws-openapi.json, openapi/tackleio-offers-msft-openapi.json,
  openapi/tackleio-platform-openapi.json, openapi/tackleio-prospect-openapi.json, openapi/tackleio-scim-openapi.json
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: tackleJwt
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Tackle-issued JWT (interactive user or MTM token).
  sources:
  - openapi/tackleio-contracts-openapi.json
  - openapi/tackleio-cosell-aws-openapi.json
  - openapi/tackleio-cosell-gcp-openapi.json
  - openapi/tackleio-cosell-msft-openapi.json
  - openapi/tackleio-offers-aws-openapi.json
  - openapi/tackleio-offers-msft-openapi.json
  - openapi/tackleio-platform-openapi.json
  - openapi/tackleio-prospect-openapi.json
- name: BasicAuthCallback
  type: http
  scheme: basic
  description: Use `basic` for [basic HTTP authentication](https://en.wikipedia.org/wiki/Basic_access_authentication);
    this is only used for `callbacks`
  sources:
  - openapi/tackleio-platform-openapi.json
- name: HeaderApiKeyAuthCallback
  type: apiKey
  in: header
  parameter: subscription-key
  description: Use `header_api_key` to specify a custom HTTP request header for authentication. Requests
    from Tackle will use the specified HTTP header for outbound requests to your Webhook URL; this is
    only used for `callbacks`'
  sources:
  - openapi/tackleio-platform-openapi.json
- name: Oauth2AuthCallback
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: /oauth/token
    scopes: 0
  description: This auth-type is for `oauth2` client credentials flow. We will use the client_id and client_secret
    to call the token_url to get an access token; this is only used for `callbacks`'
  sources:
  - openapi/tackleio-platform-openapi.json
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: 'API key authentication.

    Include the API key in the Authorization header.'
  sources:
  - openapi/tackleio-scim-openapi.json
docs: https://developers.tackle.io/docs/getting-an-access-token
token_endpoint: POST https://api.tackle.io/v1/authenticate
grant: client_credentials (machine-to-machine)
idp: 'Auth0 tenant https://auth.tackle.io (OIDC: https://auth.tackle.io/.well-known/openid-configuration)'
token_ttl_seconds: 5400
notes: 'Primary API auth is an OAuth2 client-credentials JWT (Authorization: Bearer). The SCIM service
  uses a static API key. Basic/header-api-key/oauth2 callback schemes secure outbound webhook delivery
  only.'